• Convergence Security Journal
• /
• v.20 no.3
• /
• pp.115-123
• /
• 2020

Cyber Attack have evolved more and more in recent years. One of the best countermeasure to counter this advanced and sophisticated cyber threat is to predict cyber attacks in advance. It requires a lot of information and effort to predict cyber threats. If we use Open Source Intelligence(OSINT), the core of recent information acquisition, we can predict cyber threats more accurately. In order to predict cyber threats using OSINT, it is necessary to establish a Database(DB) for cyber attacks from OSINT and to select factors that can evaluate cyber threats from the established DB. We are based on previous researches that built a cyber attack DB using data mining and analyzed the importance of core factors among accumulated DG factors by AHP technique. In this research, we present a method for quantifying cyber threats and propose a cyber threats prediction model based on artificial neural networks.

• Journal of the Korea Society of Computer and Information
• /
• v.15 no.4
• /
• pp.19-25
• /
• 2010

In this paper, the performance of the DoS information security algorithm is evaluated to provide the multimedia traffic between the nodes using the multicasting services. The essence technology for information security to distribute the multimedia contents is presented. Under the multicasting services, a node participating new group needs a new address and the node compares the collision with the existing nodes, then DoS attack can be occurred between the nodes by a malicious node. Using the NS2 simulator, the number of DoS attacks, the average number of trials to generate new address, and the average time to create address are analyzed. From simulation results, the efficient algorithm with relevant random number design according to the DRM network is needed to provide secure multimedia contents distribution.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.3
• /
• pp.769-776
• /
• 2016

Recently, cyber attacks are continuously threatening the cyberspace of the state across the border. Such cyber attacks show a surface which is intelligent and sophisticated level that can paralyze key infrastructure in the country. It can be seen well in cases, such as hacking threat of nuclear power plant, 3.20 cyber terrorism. Especially in public institutions of the country in which there is important information of the country, advanced prevention is important because the large-scale damage is expected to such cyber attacks. Technical support is also important, but by improving the cyber security awareness and security expert knowledge through the cyber security education to the country's public institutions workers is important to raise the security level. This paper suggest education courses for the rise of the best security effect through a short-term course for the country's public institutions workers.

• Journal of Internet Computing and Services
• /
• v.20 no.1
• /
• pp.1-10
• /
• 2019

Since big-data text mining extracts many features and data, clustering and classification can result in high computational complexity and low reliability of the analysis results. In particular, a term document matrix obtained through text mining represents term-document features, but produces a sparse matrix. We designed an advanced genetic algorithm (GA) to extract features in text mining for detection model. Term frequency inverse document frequency (TF-IDF) is used to reflect the document-term relationships in feature extraction. Through a repetitive process, a predetermined number of features are selected. And, we used the sparsity score to improve the performance of detection model. If a spam mail data set has the high sparsity, detection model have low performance and is difficult to search the optimization detection model. In addition, we find a low sparsity model that have also high TF-IDF score by using s(F) where the numerator in fitness function. We also verified its performance by applying the proposed algorithm to text classification. As a result, we have found that our algorithm shows higher performance (speed and accuracy) in attack mail classification.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.23 no.4
• /
• pp.477-485
• /
• 2019

As the drones industry evolved, the security of the drone network has been important. In this paper, MTD (Moving Target Detection) technique is applied to the drone network for improving security. The existing MTD scheme has a risk that the hash value is exposed during the wireless communication process, and it is restricted to apply the one-to-many network. Therefore, we proposed PHT (Preposition Hash Table) scheme to prevent exposure of hash values during wireless communication. By reducing the risk of cryptographic key exposure, the use time of the cryptographic key can be extended and the security of the drone network will be improved. In addition, the cryptographic key exchange is not performed during flight, it is advantageous to apply PHT for a swarm drone network. Through simulation, we confirmed that the proposed scheme can contribute to the security of the drone network.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.32 no.3
• /
• pp.555-564
• /
• 2022

Recently, cyberattacks are using hacking techniques utilizing intelligent and advanced malicious codes for non-face-to-face environments such as telecommuting, telemedicine, and automatic industrial facilities, and the damage is increasing. Traditional information protection systems, such as anti-virus, are a method of detecting known malicious URLs based on signature patterns, so unknown malicious URLs cannot be detected. In addition, the conventional static analysis-based malicious URL detection method is vulnerable to dynamic loading and cryptographic attacks. This study proposes a technique for efficiently detecting malicious URLs by dynamically learning malicious URL data. In the proposed detection technique, malicious codes are classified using machine learning-based feature selection algorithms, and the accuracy is improved by removing obfuscation elements after preprocessing using Weighted Euclidean Distance(WED). According to the experimental results, the proposed machine learning-based malicious URL detection technique shows an accuracy of 89.17%, which is improved by 2.82% compared to the conventional method.

• Journal of Platform Technology
• /
• v.12 no.3
• /
• pp.27-40
• /
• 2024

Collaborative programs are tools designed to support multiple people working together, enhancing collaboration and communication efficiency, improving productivity, and overcoming the constraints of time and place. In the endemic era, many companies and individuals prefer using collaborative programs. These programs often handle sensitive information, such as work content, documents, and user data, which can cause significant damage if leaked. Exploiting this, various attack scenarios have emerged, including malware attacks disguised as collaborative programs, exploiting vulnerabilities within these programs, and stealing internal tokens. To prevent such attacks, it is essential to analyze and respond to potential threats proactively. This paper focuses on Notion, a widely used collaborative program, to collect and analyze artifacts related to user information and activities in both PC and Android environments. Based on the collected data, we categorize critical information, discuss potential threats, and propose countermeasures.

• Review of KIISC
• /
• v.20 no.6
• /
• pp.73-87
• /
• 2010

정신한은행은 '10년 1 월부터 6월까지 약 6개월 동안 "위험관리 기반의 침해사고 조기 대응체계 구축" 프로젝트를 수행하여 침해 시도 조기 탐지 및 대응을 위한 "침해사고 조기 경보 시스템" 및 "침해 사고 대응 프로세스 전산화"와 침해 사고의 사전 예방 강화를 위한 "정보시스템 상시 취약점 점검 체계"를 모두 하나의 프레임웍으로 묶어 통합 구축하였다. 신한은행은 이를 통해 내부망 및 인터넷 서비스망에 대해서 이마 알려진 네트웍 침입 패턴뿐만 아니라 네트웍 트래픽 전반에 대한 모니터링을 대폭 강화하여 기존 침입탐지 시스템이나 디도스 대응 시스템 등에서 탐지가 불가능했던 신종 침입 유형이나 소규모 디도스 공격 트래픽도 자동화된 탐지가 가능하게 되었다. 그리고 탐지된 침입시도의 유행 및 위험 수준에 따라서 사전 정의된 침해사고 대응 프로세스를 통해, 정보보안 담당자가 관련 부서 및 경영진의 요구사항에 각각 최적화된 전용 상황 모니터링 화면을 공유하며 침해사고를 효과적으로 공동 대응할 수 있게 되었다. 또한 정보시스템 전반에 대하여 상시 취약점 점검을 실시하고 그 점검 결과를 데이터베이스로 구축하고 정보시스템의 위험 수준에 따른 체계화된 대응 방안을 수립할 수 있게 되었다. 신한은행은 금번 구축된 시스템을 정보보안 영역 전반으로 확대하여 동일 프레임웍에서 위험관리 기반의 내부 정보 유출 체계를 구축하고, 향후 그룹사에도 확대 적용하여 전체 그룹사의 보안 수준을 제고하는 데 활용할 계획이다. * 금번 구축 사례에서 소개된 침해사고 조기 대응체계는 구축 완료 시점에 사내 명칭 공모를 통해 "Ageis"로 선정되었으며, 본 사례에서도 전체 시스템을 가리킬 때 Ageis로 지칭한다. Aegis는 그라스 신화에서 Zeus 신이 딸 Athena 신에게 주었다는 방패로서 보호, 후원, 지도 등의 뜻을 가지며, 이지스 또는 아이기스 라고 발음된다.

• The Korean Journal of Elementary Counseling
• /
• v.11 no.2
• /
• pp.133-151
• /
• 2012

The purpose of this study was to examine the effects of the conflict resolution program on children's psychological well-being, empathy, and aggression. The subjects of this study were 2 classes from fourth grade D elementary school in Daegu. One class(31 students) was placed in an experimental group and the other class(32 students) was placed in a control group. The research design of this study is based on a pre-test and a post-test between the both groups. With the test data, the students feedbacks were collected to identify the subject's responds to the program. Item data were analyzed by repeated measures MANOVA(two-factor mixed design). The quantitative results of this study were as follows: First, compared to the control group, the experimental group that participated in the conflict resolution program showed a significant improvement in psychological well-being. Second, compared to the control group, the experimental group that participated in the conflict resolution program showed a significant improvement in empathy. compared to the control group, the experimental group that participated in the conflict resolution program showed a significant decrease in aggression. These results were supported and intensified by qualitative data based on comment papers and questionnaire. In conclusion, the conflict resolution program can be an effective tool for the improvement of psychological well-being and empathy, and the decrease of aggression.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.27 no.4
• /
• pp.961-970
• /
• 2017

The differential power analysis calculates the intermediate value related to sensitive information and substitute into the power model to obtain (hypothesized) power consumption. After analyzing the calculated power consumption and measuring power consumption, the secret information value can be obtained. Hamming weight and hamming distance models are most commonly used power consumption model, and the power consumption model is obtained through the modeling technique. If the power consumption model assumed by the actual equipment differs from the power consumption of the actual equipment, the side channel analysis performance is declined. In this paper, we propose a method that records measured power consumption and exploits as power consumption model. The proposed method uses the power consumption at the time when the information (plain text, cipher text, etc.) available in the encryption process. The proposed method does not need template in advance and uses the power consumption measured by the actual equipment, so it accurately reflects the power consumption model of the equipment.. Simulation and experiments show that by using our proposed method, side channel analysis is improved on the existing power modeling method.